linera[.]bet

The domain linera.bet was registered on April 2, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is currently classified as active and assigned a high risk level. The site’s page title reports “Just a moment…”, which is consistent with a typical brand‑impersonation landing page. The domain is explicitly targeting the Linea brand. Infrastructure analysis shows the domain resolves to the Cloudflare IP address 172.67.128.183, which is geolocated to Canada and hosted by Cloudflare, Inc. Both authoritative nameservers are irma.ns.cloudflare.com and konnor.ns.cloudflare.com. The site serves a Let’s Encrypt certificate issued under the “E7” profile, and HTTP requests return a 403 status code. Reputation metrics are poor: Gridinsoft assigns a trust score of 0/100, the domain appears on one security blocklist, and AlienVault OTX lists it in a single threat‑intelligence pulse. VirusTotal records a single detection out of 95 scanners, and PhishDestroy has already blocked the domain. These indicators collectively confirm a brand‑impersonation campaign aimed at deceiving users of the Linea platform. The presence of a valid SSL certificate and a Cloudflare front‑end suggests an attempt to appear legitimate, while the 403 response indicates that the malicious content may be concealed behind additional checks or requires specific user interaction. The exact payload, such as credential‑stealing forms or malicious redirects, cannot be verified from the available data. Defenders should add linera.bet to deny‑list or sinkhole rules, monitor DNS queries for the associated Cloudflare nameservers, and enforce web‑filtering blocks on the IP 172.67.128.183. Continuous re‑scanning with virus‑analysis engines is advised to detect any changes in payload behavior. Organizations using the Linea brand should educate users about the “Just a moment…” landing page and verify URLs before entering credentials.